CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.11)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL Injection vulnerability in PrinterLogic Web Stack versions 19.1.1.13 SP9 and below allows an attacker to inject malicious SQL code, potentially gaining unauthorized access to additional audit records.
A reflected XSS vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.
Reprise License Manager 14.2 is affected by a reflected XSS vulnerability in the 'count' parameter of the /goform/activate_process endpoint. No authentication is required.
W wersji 1.4.0 Trusted Firmware-M (TF-M) przy użyciu profilu Small występuje nieprawidłowa kontrola dostępu. NSPE może uzyskać dostęp do zabezpieczonego klucza (przechowywanego przez usługę Crypto) jedynie na podstawie znajomości jego identyfikatora klucza.
Fluxbb version 1.4.12 is affected by a Cross Site Scripting (XSS) vulnerability. This allows an attacker to inject malicious JavaScript code into pages viewed by other users.
An information exposure issue has been discovered in Opmantek Open-AudIT 4.2.0. The vulnerability allows an authenticated attacker to read files outside of the restricted directory.
Wersje Apache Log4j2 od 2.0-beta7 do 2.17.0 (z wyłączeniem poprawek bezpieczeństwa 2.3.2 i 2.12.4) są podatne na atak zdalnego wykonania kodu (RCE) przy użyciu konfiguracji z JDBC Appender i źródłem danych JNDI LDAP, gdy atakujący ma kontrolę nad docelowym serwerem LDAP. Problem został rozwiązany poprzez ograniczenie nazw źródeł danych JNDI do protokołu java w wersjach Log4j2 2.17.1, 2.12.4 i 2.3.2.
A cross-site scripting (XSS) vulnerability was found in S-CMS Government Station Building System v5.0 in the /function/booksave.php file. It allows an attacker to inject malicious client-side scripts.
A cross-site scripting (XSS) vulnerability was found in the search function of S-CMS Government Station Building System v5.0. It allows injection of malicious JavaScript code into the page.
Wersje Apache Log4j2 od 2.0-alpha1 do 2.16.0 (z wyjątkiem 2.12.3 i 2.3.1) nie chroniły przed niekontrolowaną rekurencją w przypadku samoodwołujących się wyszukiwań. Umożliwia to atakującemu, który ma kontrolę nad danymi w Thread Context Map, spowodowanie odmowy usługi podczas interpretacji spreparowanego ciągu.
Verint Workforce Optimization (WFO) version 15.2.8.10048 is vulnerable to Cross-Site Scripting (XSS) via the NEWUINAV parameter in the control/my_notifications endpoint. An attacker can inject malicious JavaScript code that executes in the victim's browser.
A cross-site scripting (XSS) vulnerability was found in Genesys Workforce Management 8.5.214.20 during record deletion via the Time-off parameter. An attacker can inject a malicious script that executes in the victim's browser.
A cross-site scripting (XSS) vulnerability was found in LimeSurvey 3.6.2+180406 in the theme.php controller. Attackers can inject arbitrary web script or HTML via the changes_cp parameter in requests to the index.php/admin/themes/sa/templatesavechanges URI.
A Cross Site Scripting (XSS) vulnerability exists in the redirect module of Racktables version 0.21.2. An attacker can inject arbitrary web script or HTML via the op parameter.
An issue was discovered in Mahavitaran android application 7.50 and below, allowing local attackers to read cleartext username and password while the user is logged into the application.
Chamilo LMS version 1.11.14 is affected by a Cross Site Scripting (XSS) vulnerability in /plugin/jcapture/applet.php. An attacker can exploit this by passing a hex2bin encoded message in the cookie.
An IDOR vulnerability in ICREM H8 SSRMS allows unauthorized access to sensitive information via the Print Invoice Functionality. Attackers can exploit this flaw to read data without proper permissions.
All versions of GitLab CE/EE before 14.2.6, versions from 14.3 to 14.3.4, and versions from 14.4 to 14.4.1 accidentally log the system root password in migration logs. This allows an attacker with local file system access to obtain root-level privileges.
CVE-2021-39904 describes an improper access control vulnerability in the GraphQL API in all versions of GitLab CE/EE from 13.1 to 14.2.6, from 14.3 to 14.3.4, and from 14.4 to 14.4.1. This allows a Merge Request creator to resolve discussions and apply suggestions after a project owner has locked the Merge Request.
An XSS vulnerability in Pandora FMS up to version 755 allows an attacker to inject malicious script by creating a new event filter with a crafted name.